"use strict";
Object.defineProperty(exports, "__esModule", {
    value: true
});
function _export(target, all) {
    for(var name in all)Object.defineProperty(target, name, {
        enumerable: true,
        get: Object.getOwnPropertyDescriptor(all, name).get
    });
}
_export(exports, {
    get checkFhirBundleWritePermission () {
        return checkFhirBundleWritePermission;
    },
    get checkFhirReadPermission () {
        return checkFhirReadPermission;
    },
    get checkFhirWritePermission () {
        return checkFhirWritePermission;
    },
    get checkFhirWritePermissionForResource () {
        return checkFhirWritePermissionForResource;
    }
});
const _expressasynchandler = /*#__PURE__*/ _interop_require_default(require("express-async-handler"));
const _constants = require("@tamanu/constants");
const _fhir = require("@tamanu/shared/utils/fhir");
function _interop_require_default(obj) {
    return obj && obj.__esModule ? obj : {
        default: obj
    };
}
let FhirForbiddenError = class FhirForbiddenError extends _fhir.FhirError {
    constructor(message){
        super(message, {
            status: 403,
            code: _constants.FHIR_ISSUE_TYPE.SECURITY.FORBIDDEN
        });
    }
};
function getPermissionNoun(fhirResourceName) {
    return _constants.FHIR_RESOURCE_TO_PERMISSION_NOUN[fhirResourceName];
}
function hasAnyServiceRequestReadPermission(ability) {
    return Object.values(_constants.SERVICE_REQUEST_PERMISSION_NOUNS).some((noun)=>ability.can('read', noun));
}
function checkFhirReadPermission(FhirResource) {
    return (0, _expressasynchandler.default)(async (req, _res, next)=>{
        const { ability } = req;
        if (FhirResource.fhirName === 'ServiceRequest') {
            if (!hasAnyServiceRequestReadPermission(ability)) {
                throw new FhirForbiddenError('No permission to read ServiceRequest');
            }
        } else {
            const noun = getPermissionNoun(FhirResource.fhirName);
            if (!noun || !ability.can('read', noun)) {
                throw new FhirForbiddenError(`No permission to read ${FhirResource.fhirName}`);
            }
        }
        next();
    });
}
function checkFhirWritePermission(FhirResource) {
    return (0, _expressasynchandler.default)(async (req, _res, next)=>{
        const { ability } = req;
        const noun = getPermissionNoun(FhirResource.fhirName);
        if (!noun || !ability.can('write', noun)) {
            throw new FhirForbiddenError(`No permission to write ${FhirResource.fhirName}`);
        }
        next();
    });
}
const ALL_WRITE_NOUNS = [
    ...new Set([
        ...Object.values(_constants.FHIR_RESOURCE_TO_PERMISSION_NOUN),
        ...Object.values(_constants.FHIR_INTEGRATION_PERMISSIONS).flatMap((c)=>c.write)
    ])
];
function checkFhirBundleWritePermission() {
    return (0, _expressasynchandler.default)(async (req, _res, next)=>{
        const { ability } = req;
        const hasAnyWrite = ALL_WRITE_NOUNS.some((noun)=>ability.can('write', noun));
        if (!hasAnyWrite) {
            throw new FhirForbiddenError('No write permissions for any FHIR resource');
        }
        next();
    });
}
function checkFhirWritePermissionForResource(ability, fhirResourceName) {
    const noun = getPermissionNoun(fhirResourceName);
    if (!noun || !ability.can('write', noun)) {
        throw new FhirForbiddenError(`No permission to write ${fhirResourceName}`);
    }
}

//# sourceMappingURL=fhirPermissions.js.map